Session Handoff [default]: #1739's Two-Channel Skills Report Released as 2.0.661, and #1756 Is Decided #1761

One deliverable, start to finish: #1739 is implemented as decided, merged in #1755, promoted in #1760, and released as 2.0.661. skills_install.py --report now answers the Codex and opencode snapshot and the live Claude Code checkout separately. A correctly finished merge-and-release run now reads current after step 8, which was measured on this machine at release.

Next steps, in priority order

Re-ranked from #1753. Re-read each issue rather than trusting these summaries.

1. Implement Bootstrap registers its temporary tree as the live Claude Code skills source, then deletes it #1756 as decided. The maintainer chose to clone the hub durably. When the bootstrap's host mode finds no hub clone, it clones the hub into the fleet layout's base-clone location and runs the skills installer from there, not from the extracted tarball. The decision comment is the spec. Done looks like a fresh bootstrap.sh --host whose --report shows live.checkout as an existing clone rather than a reason saying the checkout doesn't exist. bootstrap.sh and bootstrap.ps1 both change, and the PowerShell side needs a native Windows run before it counts as fixed.
2. Act on A regex pins a phrase inside a # comment, so rewrapping that comment fails the test with a false explanation #1732. Carried unchanged: three assertions pin a whitespace-bearing needle against wrappable Python. Nothing started.
3. Work the skills_install.py follow-ups: skills_install --report follow-ups: stamp-less live report, bootstrap remedy text, --intended guard test #1759, then skills_install source_ref hides ignored files and trusts an enclosing git repo #1758, then skills_install --report's live channel does not check that the plugin is installed and enabled #1757.
   • skills_install --report follow-ups: stamp-less live report, bootstrap remedy text, --intended guard test #1759 is the cheapest: one snapshot JSON schema, the missing --intended guard test, and the bootstrap remedy text.
   • skills_install source_ref hides ignored files and trusts an enclosing git repo #1758 holds the source_ref gaps. The per-path dirty flag in skills_install source_ref hides ignored files and trusts an enclosing git repo #1758 changes the stamp's shape, so decide first whether stampVersion bumps.
   • skills_install --report's live channel does not check that the plugin is installed and enabled #1757: the live channel doesn't check that the plugin is installed and enabled.
4. Decide whether stacked pull requests are documented or banned (A stacked pull request's diff reopens after the parent squash-merges, and nothing documents it #1742). Carried. It's a question to ask when the work starts.
5. Bump Financial-Modeling's hub workflow pins. Carried and still unattempted. Five sites are listed on Session Handoff [default]: One Issue Closed Whose Premise Was Wrong, and a Release #1735.
6. Click Check for Updates on the four stalled repositories plus Financial-Modeling. Maintainer-only.
7. Act on the regenerated Converge Financial-Modeling with the hub baseline (32 findings) #1579, after re-running it against current main. Then The widened configuration shape misses the unspaced key=value an environment file writes #1717 and issue-ref reads no URL outside instruction text, so an own-repository tracker URL in code is banned and unreported #1719.
8. skills_install.py runs a bare claude argv, which may miss a Windows .cmd shim #1754, the Windows-only gaps in skills_install.py: the bare claude argv against a .cmd shim, and the timeout grandchild hang. It needs a native Windows host, so it waits until one is available.

External blockers

• CodeRabbit ran out of free OSS reviews on both pull requests this round. It reviewed Report the Skills Snapshot and the Live Checkout Separately #1755 up to its second-to-last head. It stays advisory, and it still needs an explicit @coderabbitai review on every pull request here.
• skills_install.py runs a bare claude argv, which may miss a Windows .cmd shim #1754 and the PowerShell half of Bootstrap registers its temporary tree as the live Claude Code skills source, then deletes it #1756 need a native Windows host. Nothing here can run one.
• Private-repo Dependabot needs the manual click in step 6.

Internal dependencies

• Step 1 before the skills_install --report follow-ups: stamp-less live report, bootstrap remedy text, --intended guard test #1759 remedy text in step 3. Once the bootstrap installs from a durable clone, its "--host or --skills lands it" message changes meaning.
• skills_install source_ref hides ignored files and trusts an enclosing git repo #1758's stamp-shape change before any other stamp edit. A stampVersion bump makes every existing machine read "not a recognized shape" until it re-installs, so it should land once.
• Steps 2, 4 and 5 are independent of each other and of the rest.

State

Every fact here is re-derived at resume rather than trusted.

• Hub: develop at the squash of Report the Skills Snapshot and the Live Checkout Separately #1755. main at the merge of Promote the Two-Channel Skills Report to Main #1760. The release was dispatched from main, its run succeeded, and the published release is 2.0.661.
• This machine's Skills were refreshed from the promoted main. With the base clone back on develop, --report exits 0, the snapshot reads current, and live names develop. That is skills_install's two channels disagree: Claude Code loads the checkout in place while the copy holds the promoted revision #1739's done criterion, measured.
• Open pull requests: none of this track's. No feature branch of this track remains, locally or on the remote, and the base clone is clean on develop.
• Worktrees: the detached helpers left by other parties, down from the eight this round started with. None of them belongs to this track. Treat git worktree list as something another party may be changing.
• Backlog size, read with an explicit page size: 301 open hub issues excluding the handoff label. This round filed five and closed one.

The parked decision queue

Empty. No open issue carries the decision label. This session put five questions to the maintainer and got answers, each recorded on its issue or pull request:

1. skills_install's two channels disagree: Claude Code loads the checkout in place while the copy holds the promoted revision #1739's default intended revision: origin/main.
2. skills_install's two channels disagree: Claude Code loads the checkout in place while the copy holds the promoted revision #1739's exit code: the snapshot verdict alone.
3. The review-loop stop point on Report the Skills Snapshot and the Live Checkout Separately #1755: revert the exit code 2, make the small fixes, file the rest.
4. Whether to merge and release Promote the Two-Channel Skills Report to Main #1760: merge and release.
5. Bootstrap registers its temporary tree as the live Claude Code skills source, then deletes it #1756: clone the hub durably.

What the last round did

• Shipped skills_install's two channels disagree: Claude Code loads the checkout in place while the copy holds the promoted revision #1739, all in skills_install.py and its docs:
  • Merged Report the Skills Snapshot and the Live Checkout Separately #1755, promoted it in Promote the Two-Channel Skills Report to Main #1760, and released 2.0.661.
  • --report prints a snapshot object and a live object, and its exit code is the snapshot's verdict alone.
  • merge-and-release step 7 now states the split between the two channels.
  • The refresh cadence now reads "from a freshly fetched main after a promotion".
• Filed skills_install.py runs a bare claude argv, which may miss a Windows .cmd shim #1754, Bootstrap registers its temporary tree as the live Claude Code skills source, then deletes it #1756, skills_install --report's live channel does not check that the plugin is installed and enabled #1757, skills_install source_ref hides ignored files and trusts an enclosing git repo #1758, and skills_install --report follow-ups: stamp-less live report, bootstrap remedy text, --intended guard test #1759 from local and bot review findings, and recorded the Bootstrap registers its temporary tree as the live Claude Code skills source, then deletes it #1756 decision.

What not to repeat

• Don't accept "Claude Code serves the plugin cache" from a reviewer. Two review passes raised it, pointing at installPath in the CLI's plugin state, which names a month-old cache directory. It's wrong: the harness reports a skill's base directory inside the hub checkout, and a loaded skill carried develop-only text that the cache lacks. skills_install's two channels disagree: Claude Code loads the checkout in place while the copy holds the promoted revision #1739's own credit section warned about exactly this trap. Cost: one pass's worth of findings to disprove.
• Don't add an exit code in a fix round. An exit 2 for "cannot judge", added to answer one finding, contradicted six surfaces that say "re-install when --report exits non-zero". The next pass found that, and the round was spent reverting it. Put a new state in the JSON instead.
• Don't pass --arg to gh --jq. Pipe to jq instead. The release-run correlation lost one call to this. It's a known trap, already in memory.
• Don't chain cat >> /dev/null into a script. With no stdin it blocks until the tool times out. Give every command </dev/null in a long compound.

New learnings

• A skill's text is fixed for the session at load. merge-and-release, loaded after Report the Skills Snapshot and the Live Checkout Separately #1755 was already on develop, still showed the old step 7, so skill content is read once per session rather than on every invocation. Recorded in memory.
• Every local review pass drew findings until the change stopped moving. There were eight recorded passes with 6, 2, 5, 5, 3, 2, 2, and 0 findings, and the only clean pass was over a one-line comment. That matches the existing memory that new content doesn't converge under review, and the two-round budget is what ended the loop.